| Package | Affected versions | Patched versions |
|---|---|---|
| wagtail | ≥ 7.1, < 7.3.3≥ 7.4, < 7.4.2< 7.0.8 | 7.3.37.4.27.0.8 |
| wagtail | ≥ 7.1, < 7.3.3≥ 7.4, < 7.4.2< 7.0.8 | 7.3.37.4.27.0.8 |
A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.
Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
N/A
Many thanks to @devansh3008 and @alanturing881 for reporting this issue.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free